Never even thought of that; I don’t know. I assumed it was when a write was done. Whatever that means, I don’t know either.

Would this mean that fs event based antivirus scanners could be side-stepped by writing a payload to a file and then never closing the handler?

Good point here, I will definitely check this and report back. :)